HIM 500 Module 5 Final Project Milestone Two Example

Final Project Milestone Two: The Rules Behind the Record, Legal and Regulatory Ramifications for Three Technologies at Bramble Bay

[Student Name]

Southern New Hampshire University

HIM 500: Healthcare Informatics

Final Project Milestone Two

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone Two: The Rules Behind the Record, Legal and Regulatory Ramifications for Three Technologies at Bramble Bay

Milestone One gave Bramble Bay Medical Center a seven-step process for evaluating technology, with legal review as its fourth step. This milestone carries out that step for the three proposals now under review: an ambient documentation tool from the record vendor, an expanded decision support package that includes predictive models and membership in a national exchange network. It first summarizes the legal framework, then applies each part to each technology.

HIPAA Privacy, Security and Breach Rules

The HIPAA Privacy Rule governs how covered entities and their business associates use and disclose protected health information, permitting treatment, payment and operations uses without authorization and giving patients rights of access and amendment. The Security Rule requires a documented risk analysis and reasonable safeguards for electronic information, ranging from written policies and building security to system features such as role-based access, audit trails and, where reasonable, encryption. When unsecured information is compromised, the Breach Notification Rule sets out who must be told: the affected people, federal regulators and, for larger incidents, the press. Cohen and Mello (2018) argue that HIPAA, written for a world of paper and billing, now leaves large gaps: it covers health care organizations and their vendors but not many companies that hold health data, and its de-identification standard may not prevent re-identification when data sets are combined.

Information Blocking and Sensitive Records

Under the 21st Century Cures Act, interfering with the sharing of electronic health information became a violation for health care providers, certified health IT developers and exchanges, subject to defined exceptions for situations such as preventing harm, privacy, security and infeasibility. Adler-Milstein and Pfeifer (2017) surveyed exchange leaders before the rules took effect and found that many believed vendors and health systems routinely blocked information, often for competitive reasons, which explains why regulators treat it seriously. Records of federally assisted substance use disorder programs fall under a separate confidentiality regulation, known as Part 2, which after its 2024 revision lets one signed consent authorize later sharing for care, billing and operations yet still requires that such records be identified and protected.

Oversight of Decision Support and Predictive Tools

Some software used in care is regulated as a medical device. The Food and Drug Administration's guidance on clinical decision support software explains that tools meant to support clinicians' decisions may fall outside device regulation when, among other conditions, clinicians can independently review the basis for a recommendation, while software that analyzes medical images or signals, or that directs treatment without such review, may be regulated. Separately, a federal certification rule effective in 2024 requires developers of certified health IT to make information available about how predictive decision support tools in their products were developed, tested and monitored, so hospitals can judge whether a model is valid and fair for their patients.

Data Outside HIPAA, Retention and Legal Holds

When patient data leave covered entities, different rules apply. Price and Cohen (2019) describe how medical big data flow among companies outside HIPAA and argue that privacy protections have not kept pace. For consumer health apps and similar services not covered by HIPAA, a breach notification rule enforced by the Federal Trade Commission requires notice when health data are disclosed without authorization. Finally, anything that becomes part of the record, including new data types such as audio-derived notes, falls under the hospital's retention schedule and, when litigation is anticipated, under legal hold obligations that suspend routine destruction.

Ramifications for Each Technology

Table 1 applies the framework to the three proposals.

Table 1. Legal and Regulatory Ramifications by Technology

Note. Analysis by the author for the steering committee; not legal advice.

Most Important Findings

Three findings stand out. Ambient documentation carries the most new legal exposure because it creates recordings that did not exist before; the contract must settle whether the vendor keeps audio, whether it may use recordings to train its models and how quickly it deletes them, and the hospital must decide whether and how patients are told. Expanded decision support raises the question of whether each predictive model has been validated for Bramble Bay's population, which the new transparency information should help answer. National exchange reduces blocking risk and improves care but requires segmentation of Part 2 records before the hospital joins. The ransomware counts assembled by Neprash et al. (2022) climbed year after year and frequently involved interrupted care, a reminder that every new connection and vendor must pass the security risk analysis.

Questions for Counsel and Compliance

Several questions go beyond what a health information analysis can settle and should go to the hospital's counsel and compliance officer before any contract is signed. Does Georgia law or hospital policy require patient consent, or only notice, before a visit is recorded by an ambient tool? Would a vendor's use of de-identified transcripts to train its models be a permitted use under the business associate agreement, or a sale or disclosure the hospital must prohibit? Which of the predictive models in the decision support package, if any, might meet the definition of a regulated device? And what segmentation of Part 2 records does the national network require of participants? Recording these questions in the evaluation file ensures they are answered in writing rather than assumed.

Conclusion

No proposal is barred by law, but each carries duties that must be met before and after adoption. The legal review turns those duties into conditions: contract terms for ambient documentation, validation evidence for predictive tools and record segmentation for exchange. Milestone Three will combine these conditions with the rest of the evaluation to produce recommendations.

References

Adler-Milstein, J., & Pfeifer, E. (2017). Information blocking: Is it occurring and what policy strategies can address it? Milbank Quarterly, 95(1), 117-135. https://doi.org/10.1111/1468-0009.12247

Cohen, I. G., & Mello, M. M. (2018). HIPAA and protecting health information in the 21st century. JAMA, 320(3), 231-232. https://doi.org/10.1001/jama.2018.5630

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

Price, W. N., & Cohen, I. G. (2019). Privacy in the age of medical big data. Nature Medicine, 25(1), 37-43. https://doi.org/10.1038/s41591-018-0272-7